Secure Coding Practices

Input validation, output encoding, error handling, and secure development lifecycle.

Overview

Secure coding prevents vulnerabilities at the source.

Input Validation

# Whitelist validation
import re

def validate_username(username):
    if not re.match(r'^[a-zA-Z0-9_]{3,20}$', username):
        raise ValueError("Invalid username")
    return username

# Type checking
def validate_age(age):
    if not isinstance(age, int) or not (0 <= age <= 150):
        raise ValueError("Invalid age")
    return age

Output Encoding

# HTML encoding
import html

def encode_html(text):
    return html.escape(text)

# JavaScript encoding
def encode_js(text):
    return text.replace('\\', '\\\\')
               .replace("'", "\\'")
               .replace('"', '\\"')
               .replace('\n', '\\n')
               .replace('\r', '\\r')

SQL Injection Prevention

# Parameterized queries
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

# ORM usage
user = User.query.filter_by(id=user_id).first()

XSS Prevention

# Content Security Policy
@app.after_request
def add_csp(response):
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    return response

# Auto-escaping templates (Jinja2)
return render_template('index.html', user_input=user_input)

Error Handling

# Don't expose internals
try:
    result = risky_operation()
except Exception as e:
    logger.error(f"Operation failed: {e}")
    return jsonify({"error": "Internal server error"}), 500

Secure Development Lifecycle

1. Requirements → Security requirements
2. Design → Threat modeling
3. Implementation → Secure coding
4. Testing → Security testing
5. Deployment → Secure configuration
6. Maintenance → Patch management

Code Review Checklist

• Input validation present
• Output encoding implemented
• Parameterized queries used
• Error handling secure
• Authentication enforced
• Authorization checked
• Secrets not hardcoded
• Dependencies updated

Practice

Review code for vulnerabilities and implement fixes.